Hello Reader,
In the prior post we talked aboutt the differences between USN v2, v3 and v4. I thought it would be good to a bit more into v4 and why it may be creating evcen more useful data for you. v4 stores 'data ranges' which means that it tells you what sectors on the disk where involved in a change.
What does that mean for you?
1. If a file was deleted you have the data ranges it previously existed in, even if it was fragmented
2. If a file was changed you can see what blocks may have nay previous partial contents
What gets more interesting is that in the testing done it also appears that in some cases its not just the ranges of data that is being written to the USN Journal but some of the contents of those sectors as well. I'm going to be doing some testing to see if this limited to just resident files or if like EXT4 it will record the contents of all blocks changed!
Also Read: USN Versions (2, 3 and 4)
Post a Comment